World Leaks Ransomware Expands Its Victim List with Tata and Reliance-Linked NPCIL in India

Executive Summary

World Leaks, launched on January 1, 2025, is a data-extortion group and rebrand of the former Hunters International RaaS operation, which shut down in November 2024. It follows an exfiltration-first model, stealing and leaking sensitive data instead of encrypting systems. The group has claimed over 170 victims across 29 countries and recently increased targeting of Indian entities, including a disclosure linked to the Kudankulam Nuclear Power Project through a contractor server hosted by Yotta.

Threat Profile

Group Overview

World Leaks is a data-extortion-focused threat group that operates using:

The group is a direct rebrand of Hunters International. Hunters International's operators announced the closure of that project on November 17, 2024, citing that ransomware had become too risky and unprofitable due to law enforcement pressure and geopolitical conditions. On January 1, 2025, the same operators relaunched under the World Leaks name with an explicit "no encryption" positioning. Researchers assess this as a rebrand with high confidence, based on reuse of the predecessor's exfiltration tooling, a near-identical affiliate panel and leak-site layout, and continuity of operators and negotiation methodology. The group has publicly denied collaboration with other threat actors and has issued impersonation warnings directing victims to verify contact only through its own listed onion addresses.

Operational Characteristics

World Leaks runs an Extortion-as-a-Service (EaaS) affiliate model built around a proprietary data-exfiltration tool rather than an encryption payload, marking a deliberate departure from its predecessor's ransomware structure.

Victimology

Overview

World Leaks has sustained a steady operational cadence since relaunch, briefly interrupted by an early-2025 infrastructure stability issue that delayed its first published victim to late April 2025. Since then, listing activity has been consistent, with a marked increase in high-profile disclosures through mid-2026.

The victim set spans small and mid-sized firms as well as large multinational institutions, including automotive and electronics manufacturers, financial-services subsidiaries, healthcare networks, public-sector bodies, and critical-infrastructure-adjacent contractors. This variation suggests targeting driven by accessible entry points and data value rather than a fixed size or sector preference.

Geographical Distribution

World Leaks exhibits a broad but unevenly weighted victim footprint, with strong dominance in the United States alongside an expanding international presence.

World Leaks exhibits a broad but unevenly weighted victim footprint, with strong dominance in the United States alongside an expanding international presence. The United States represents the primary concentration of victims (91 victims), significantly outweighing all other regions. The next most affected countries are the United Kingdom (10), Brazil (8), Germany (8), Canada (7), and India (7), followed by Japan (5) and Taiwan (4). Additional, lower-volume activity spans Italy, Spain, France, Switzerland, Belgium, Indonesia, Mexico, Pakistan, Sweden, Thailand, Sri Lanka, Hungary, China, Denmark, Finland, Singapore, Serbia, Australia, Colombia, Cameroon, and Romania. This distribution indicates that while the group is not geographically restricted, a discernible regional cluster has formed around Indian manufacturing, energy, and critical-infrastructure-adjacent contractors in recent months, rather than isolated opportunistic hits.

Sector Targeting

World Leaks' sector distribution reflects broad, opportunistic targeting rather than a single-industry focus, with the heaviest concentration in healthcare, followed by manufacturing and industrial production, business and professional services, technology and electronics, and consumer services. Financial services, construction, and education follow at roughly comparable levels, with energy, transportation/logistics, hospitality, and agriculture/food production forming a smaller but recurring tier. Retail, consumer goods, and public-sector or critical-infrastructure-adjacent contractors round out a broader but less frequent target set. This spread indicates that targeting is shaped primarily by exposed entry points and data value rather than a narrow vertical preference.

Technical Analysis

Initial Access and Foothold:

Recent victim disclosures and publicly reported incidents indicate that World Leaks primarily gains initial access through compromised credentials targeting internet-facing VPNs, remote-access services, and externally exposed applications. Opportunistic exploitation of vulnerable public-facing systems and phishing campaigns remain secondary access vectors. The group's operations continue to demonstrate a preference for exploiting weak identity security and externally accessible infrastructure over the use of zero-day exploits. 

The increasing concentration of victims across Indian manufacturing, financial services, and critical-infrastructure supply chains suggests deliberate targeting of organizations with high-value intellectual property, engineering documentation, supplier information, and operational records that can maximize extortion leverage after compromise. 

Privilege Escalation, Defense Evasion, and Persistence:

Persistence is commonly achieved through scheduled tasks, Registry Run key modifications, and abuse of legitimate administrative utilities following successful compromise.

Defense evasion techniques include credential theft, selective log manipulation, masquerading of malicious processes as legitimate system activity, and the abuse of trusted Windows components to reduce detection. The group relies heavily on PowerShell and Windows command-line interpreters to perform post-compromise operations while minimizing reliance on custom malware. 

Lateral Movement and Exfiltration:

Lateral Movement

World Leaks primarily performs lateral movement using valid domain accounts together with SMB and Windows administrative shares, supplemented by limited Remote Desktop Protocol (RDP) usage. Current reporting does not indicate consistent deployment of sophisticated lateral movement frameworks, with operators instead favoring legitimate administrative access and native Windows functionality. 

Attack Sequence

Data Exfiltration

Data exfiltration represents the group's primary operational objective. Affiliates are provided with a proprietary exfiltration client that automates file discovery, indexing, and transfer through SOCKSv5 proxies over the TOR network. Stolen datasets typically remain on affiliate-controlled infrastructure until negotiations conclude, after which selected files or complete datasets may be published through the World Leaks leak portal. Recent disclosures involving Tata Electronics (~630 GB), Reliance Infrastructure (~1.2 TB), and other Indian organizations demonstrate the group's capability to exfiltrate large volumes of sensitive enterprise data. 

Encryption

World Leaks publicly markets itself as an extortion-only operation that does not routinely deploy ransomware encryption. Most documented incidents involve data theft without encrypted-file artifacts. However, inherited capabilities from the Hunters International codebase indicate that encryption functionality remains available, and at least one confirmed 2026 incident involved ransomware deployment. Consequently, organizations should not assume encryption capability is absent during future intrusions. 

Command and Control (C2):

Available intelligence indicates that World Leaks operates a centralized TOR-based infrastructure consisting of a leak site, negotiation portal, affiliate management panel, and Insider journalist portal. Command-and-control and exfiltration communications are conducted through attacker-controlled infrastructure utilizing TOR and multi-hop proxy mechanisms. Public reporting provides limited protocol-level details beyond the use of anonymized communication channels and dedicated onion services for victim negotiations and affiliate operations.

Communication and Platform Analysis

World Leaks operates a four-part infrastructure: a TOR-hosted leak site with a searchable file explorer, a victim negotiation portal with live chat and Bitcoin-only payment tracking, an affiliate management panel, and an "Insider" journalist portal granting media outlets roughly 24-hour advance access to newly disclosed data ahead of public release.

The group has publicly addressed impersonation attempts, stating that its only legitimate contact points are its own listed onion addresses, and has denied formal partnerships with other groups — a claim in tension with observed shared leak-site infrastructure with at least one other extortion operation.

Negotiation Behavior 
World Leaks follows a structured, manually operated negotiation process conducted through its dedicated portal and live chat rather than email-only channels. Victims are provided access to file-browsing views of sampled stolen data to validate claims and maintain pressure. The group applies staged escalation, including partial disclosure ahead of full publication, and has built a distinct pressure mechanism — its journalist early-access program — that is not commonly seen among comparable extortion groups.

Leak Site and Infrastructure Analysis

World Leaks operates a TOR-based leak ecosystem centered on a single primary leak site paired with a separate negotiation portal and journalist portal, rather than distributed file servers. The leak site presents a searchable company directory with revenue, employee count, and stock-ticker metadata alongside view counters intended to amplify visibility-driven pressure.

The platform includes a file-explorer interface allowing browsing of individual files within a disclosed dataset rather than requiring bulk archive download, and recent updates have added HTTP Range header support for resumable downloads and compression support for bandwidth efficiency.

The ecosystem includes:

Key observations include:

Overall, World Leaks' infrastructure reflects a centralized, reputation-amplifying exposure model, where the journalist early-access mechanism and negotiation-portal design distinguish it from groups relying on distributed file servers and manual messaging alone.

NPCIL / Kudankulam Nuclear Power Project Exposure

In mid-July 2026, World Leaks disclosed a large dataset attributed to Reliance Infrastructure, the EPC contractor responsible for common-services Balance of Plant (BoP) work on Units 3 and 4 of the Kudankulam Nuclear Power Project (KKNPP) in Tamil Nadu, India.

The exposed data originated from a server belonging to Reliance Infrastructure but hosted by Yotta Data Services Pvt. Ltd., a third-party Indian data-centre provider, within an isolated private-cloud environment dedicated to that customer. Yotta stated its security monitoring detected suspicious activity on the affected server on May 29, 2026, and that the suspicious process was terminated immediately, preventing ransomware execution on that host. Yotta further stated there is no evidence of impact to any other customer environment or to its shared cloud platforms, and that no lateral movement beyond the single server was observed on its side. Reliance Infrastructure was informed of claims of a data breach by the threat actor at the end of June 2026, roughly a month after Yotta's internal detection, and has directed Yotta to conduct a full investigation.

Independent review of the group's leak-site file explorer identified approximately 19,000 files (roughly 14.3 GB) specifically matching KKNPP-related search terms, out of a much larger disclosed Reliance dataset totaling approximately 1.2 TB across 858,000+ files. The material does not appear to relate to the reactors' core nuclear systems, which are supplied by a separate foreign technical partner. It reportedly includes engineering drawings for ventilation, cooling, and common-services buildings; vendor and sub-vendor approval lists; multi-year monthly progress reports; correspondence on extension-of-time requests and change proposals; an insurance policy reportedly valued in the hundreds of millions of dollars covering acts of terrorism against the reactor units; and HR, finance, and administrative records.

The plant operator has characterized the exposed material as pertaining only to conventional common-service facilities typical of any thermal power plant, unrelated to nuclear safety or security systems. Based on available reporting, this is a data exfiltration and threatened-publication event rather than a confirmed encryption event: Yotta's own account frames the activity as a suspected ransomware execution attempt that was interrupted before completing, while the material that ultimately surfaced publicly reflects the exfiltration component of the intrusion. Even absent core reactor system exposure, drawings, vendor lists, and facility layouts of this kind can in principle help map a plant's support infrastructure and identify weaknesses in its security chain.

Recent Indian Targeting Trend  

World Leaks' actively targeting Indian entities has escalated sharply in mid-2026, forming a discernible regional cluster rather than isolated opportunistic hits.

This is also the second Tata Group subsidiary affected by this actor lineage within roughly eighteen months, a separate Tata entity having been affected under the group's prior identity — raising a recurring supply-chain question for multinational OEMs sourcing from Indian tier-one and tier-two suppliers, and for critical-infrastructure projects relying on third-party-hosted contractor infrastructure.

RANSOM NOTE

MITRE ATT&CK TTPs 

Indicators of Compromise (IOCs)

Mitigations & Recommendations

Initial Access Hardening

Identity & Credential Protection

Network Security & Lateral Movement Control

Endpoint Protection & Threat Monitoring

Data Protection & Exfiltration Prevention

External Exposure & Leak Monitoring

Third-Party & Hosting/Supply Chain Risk

Incident Response & Extortion Readiness

Conclusion

World Leaks represents the current identity of a lineage running through Hunters International, reflecting a deliberate strategic pivot toward a data-centric extortion model where the primary objective is extraction and controlled exposure of sensitive information rather than system disruption through encryption. Its operational structure — a centralized TOR-based leak ecosystem, a dedicated negotiation portal, and a journalist early-access program — demonstrates a more coordinated approach to maximizing pressure through visibility and staged disclosure than is typical among comparable extortion groups. The group's escalating focus on Indian manufacturing, electronics, and critical-infrastructure-adjacent contractors, culminating in the Kudankulam-linked disclosure, highlights both operational reach and a forming regional targeting pattern. At a strategic level, World Leaks reflects an evolving threat landscape where data itself is the primary monetized asset, while its inherited encryption capability means organizations should not treat the "extortion-only" positioning as a fixed operational limit. This trend underscores the growing importance of data protection, exposure monitoring, third-party risk management, and identity security as organizations face increasing risk from adversaries prioritizing data exploitation over traditional ransomware deployment.